/*     */ package com.zimbra.cs.account.accesscontrol;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.MailTarget;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import java.util.List;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class CrossDomain
/*     */ {
/*  38 */   private static final Log sLog = ZimbraLog.acl;
/*     */   
/*     */   static boolean crossDomainOK(Provisioning prov, MailTarget grantee, Domain granteeDomain, Domain targetDomain, Group grantedOn) throws ServiceException
/*     */   {
/*  42 */     if (!checkCrossDomain(prov, granteeDomain, targetDomain, grantedOn)) {
/*  43 */       sLog.info("No cross domain right for %s on domain %s, skipping positive grants on dl %s", new Object[] { grantee.getName(), targetDomain.getName(), grantedOn.getName() });
/*     */       
/*  45 */       return false;
/*     */     }
/*  47 */     return true;
/*     */   }
/*     */   
/*     */   static Boolean checkCrossDomainAdminRight(Provisioning prov, Domain granteeDomain, Entry target, boolean canDelegateNeeded)
/*     */     throws ServiceException
/*     */   {
/*  53 */     if (!(target instanceof Domain)) {
/*  54 */       throw ServiceException.FAILURE("internal error", null);
/*     */     }
/*     */     
/*  57 */     List<ZimbraACE> acl = ACLUtil.getAllACEs(target);
/*  58 */     if (acl == null) {
/*  59 */       return Boolean.FALSE;
/*     */     }
/*  61 */     for (ZimbraACE ace : acl)
/*     */     {
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*  72 */       if (ace.getRight() == Rights.Admin.R_crossDomainAdmin)
/*     */       {
/*  74 */         if ((ace.getGranteeType() == GranteeType.GT_DOMAIN) && (ace.getGrantee().equals(granteeDomain.getId())))
/*     */         {
/*  76 */           if (ace.deny())
/*  77 */             return Boolean.FALSE;
/*  78 */           if ((canDelegateNeeded) && (ace.canExecuteOnly())) {
/*  79 */             return Boolean.valueOf(false);
/*     */           }
/*  81 */           return Boolean.TRUE;
/*     */         }
/*     */       }
/*     */     }
/*     */     
/*  86 */     return Boolean.FALSE;
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   static boolean checkCrossDomain(Provisioning prov, Domain granteeDomain, Domain targetDomain, Group grantedOn)
/*     */     throws ServiceException
/*     */   {
/*  96 */     if (targetDomain == null) {
/*  97 */       return true;
/*     */     }
/*  99 */     Domain grantedOnTargetInDomain = grantedOn.getDomain();
/* 100 */     if (grantedOnTargetInDomain == null)
/*     */     {
/*     */ 
/*     */ 
/* 104 */       ZimbraLog.acl.warn("cannot get domain for dl " + grantedOn.getName() + " for checking cross doamin right");
/*     */       
/* 106 */       return false;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/* 111 */     if (targetDomain.getId().equals(granteeDomain.getId())) {
/* 112 */       return true;
/*     */     }
/*     */     
/*     */ 
/* 116 */     if (targetDomain.getId().equals(grantedOnTargetInDomain.getId())) {
/* 117 */       return true;
/*     */     }
/* 119 */     return checkCrossDomainAdminRight(prov, granteeDomain, targetDomain, false).booleanValue();
/*     */   }
/*     */   
/*     */   static boolean validateCrossDomainAdminGrant(Right right, GranteeType granteeType) throws ServiceException
/*     */   {
/* 124 */     if ((right == Rights.Admin.R_crossDomainAdmin) && (granteeType != GranteeType.GT_DOMAIN)) {
/* 125 */       throw ServiceException.INVALID_REQUEST("grantee for right " + Rights.Admin.R_crossDomainAdmin.getName() + " must be a domain.", null);
/*     */     }
/*     */     
/*     */ 
/* 129 */     if ((right != Rights.Admin.R_crossDomainAdmin) && (granteeType == GranteeType.GT_DOMAIN)) {
/* 130 */       throw ServiceException.INVALID_REQUEST("grantee for right " + right.getName() + " cannot be a domain.", null);
/*     */     }
/*     */     
/*     */ 
/* 134 */     return right == Rights.Admin.R_crossDomainAdmin;
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/accesscontrol/CrossDomain.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */